The inlifegram PyPI package versions 2.1.2.8 and 2.1.2.9 have been identified as malicious. The package contains obfuscated code that, upon execution, attaches backdoor commands to a Telegram bot, allowing hardcoded users to remotely execute commands in the bot's environment. This behavior classifies the package as a remote access trojan (RAT) and a malicious clone of a legitimate package. The malicious code is hidden within the library usage, making detection more difficult.

Users who install and run the affected versions of the inlifegram package risk unauthorized remote command execution by attackers with hardcoded access. This can lead to full compromise of the environment where the bot runs, potentially allowing data theft, system manipulation, or further malware deployment. The malicious functionality is specifically designed to target Telegram bot environments.

No official patch or remediation has been provided for this malicious package. Users should immediately cease using versions 2.1.2.8 and 2.1.2.9 of inlifegram and remove them from their environments. It is recommended to verify the integrity and source of any Telegram bot libraries used and rely only on trusted, verified packages from official sources. Monitor for any suspicious activity related to Telegram bots and consider rotating credentials or secrets that may have been exposed.